CVE-2026-55367

The h2o HTTP server is vulnerable to heap exhaustion due to a lack of per-Capsule limits when handling CONNECT-UDP requests. A client can send an incomplete capsule with an excessively large declared length, forcing the server to buffer received bytes indefinitely. This can lead to memory exhaust...